CVE-2026-48553
Nagios Core / XI Authenticated RCE via Custom-Variable Macro Injection
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection through the Nagios Remote Data Processor (NRDP). When a custom variable defined on a host, service, or contact is referenced in a shell-executed command line, an authenticated attacker with NRDP access can inject OS commands through the macro value. Exploitation requires a non-default configuration in which a custom variable is defined and referenced in a shell-executed command.
| CWE | CWE-78 |
| Vendor | nagios enterprises, llc. |
| Product | nagios core |
| Published | Aug 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for nagios enterprises, llc. nagios core
Be the first to know when new high vulnerabilities affecting nagios enterprises, llc. nagios core are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Nagios Enterprises, LLC. / Nagios Core
0 < 4.5.13
Nagios Enterprises, LLC. / Nagios XI
0 < 2026R1.5